# What is the Common Vulnerability Scoring System (CVSS)?

> The Common Vulnerability Scoring System (CVSS) is a framework maintained by the Forum of Incident Response and Security Teams (FIRST) for describing a vulnerability’s technical characteristics and expressing severity through metrics, a vector string, and, for scored combinations, a value from 0.0 to 10.0.

- Canonical URL: https://yellowcube.eu/glossary/common-vulnerability-scoring-system/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

CVSS version 4.0 is current. It provides a technical language; a CVSS score is not business risk, exploit probability, or mandatory remediation priority.

CVSS 4.0 separates Base metrics from Threat and Environmental metrics, with Supplemental metrics carrying additional context without changing the score. Publishing the version and full vector preserves the assumptions behind a number and lets consumers adapt the assessment to their environment.

### Key points

- **Base metrics:** These describe intrinsic technical characteristics and impacts under the framework’s assumptions, independent of a particular consumer’s deployment and current threat information.
- **Contextual refinement:** Threat metrics can reflect exploitation maturity, while Environmental metrics allow a consumer to account for local controls, requirements, and modified technical conditions.
- **Communication:** Use the score with its vector, version, metric group, source, and assessment date; identical numbers can otherwise conceal materially different attack conditions and impacts.
- **Important limitation:** CVSS does not measure asset value, business consequence, exposure, likelihood of attack, remediation cost, or control effectiveness as a complete risk model, so score-only prioritization can misdirect effort.

### Related terms

[Vulnerability](<https://yellowcube.eu/glossary/vulnerability/>) · [Common Vulnerabilities and Exposures (CVE)](<https://yellowcube.eu/glossary/common-vulnerabilities-and-exposures/>) · [National Vulnerability Database (NVD)](<https://yellowcube.eu/glossary/national-vulnerability-database/>) · [Vulnerability management](<https://yellowcube.eu/glossary/vulnerability-management/>) · [Cyber risk](<https://yellowcube.eu/glossary/cyber-risk/>)

### Sources

[FIRST: Common Vulnerability Scoring System](https://www.first.org/cvss/) · [FIRST: CVSS v4.0 specification](https://www.first.org/cvss/v4.0/specification-document) · [FIRST: CVSS v4.0 implementation guide](https://www.first.org/cvss/v4.0/implementation-guide)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.